What is malware?
Malware is malicious software designed to damage, disrupt, spy on or gain unauthorised use of systems, networks or data. The word is a blend of malicious software and covers viruses, worms, trojans, ransomware, spyware and wipers, among others. Malware is one of the greatest digital threats to both IT and OT environments: in office networks it is usually about data and money, while in industrial environments malware can halt production or even cause physical damage.
🧬 What types of malware are there?
Malware is classified by how it spreads and by what it does. A single attack often combines several types: a trojan opens the door, a worm spreads and ransomware or a wiper delivers the damage.
| Type | How it works | Relevance to OT |
|---|---|---|
| Virus | Attaches itself to files or programs and spreads when they are executed | Infected installers or project files on an engineering station |
| Worm | Spreads automatically across networks without human interaction | Very dangerous in flat OT networks with unpatched Windows systems |
| Trojan | Poses as legitimate software while opening a backdoor | Counterfeit engineering software or tampered updates |
| Ransomware | Encrypts files and demands a ransom for recovery | Hits HMIs, historians and servers; production is often stopped as a precaution |
| Spyware | Covertly collects information such as passwords or keystrokes | Theft of recipes, process data or credentials for follow-on attacks |
| Rootkit | Hides processes, files or access to maintain persistence | Stuxnet concealed both Windows files and modified PLC code |
| Wiper | Erases or destroys data and renders systems unusable, often disguised as ransomware | KillDisk and NotPetya made system recovery impossible |
| Botnet agent | Makes the system part of a remotely controlled network | Hijacked routers and IoT devices used as a stepping stone or for DDoS |
| Adware | Displays unwanted advertisements and may track user behaviour | Of little relevance in OT, but a sign of poor hygiene |
| Fileless / Living Off The Land | Uses no files of its own but abuses legitimate tools such as PowerShell and WMI | Hard to detect with classic antivirus |
🧠 How does malware get in?
Most infections start in the IT network and only reach OT in a second step. The main infection vectors are:
- Phishing - emails with malicious attachments or links to fake websites; the 2015 BlackEnergy attack began with Office attachments sent to staff at energy companies
- USB sticks and other removable media - the classic route into isolated networks; Stuxnet crossed an air gap this way
- Software vulnerabilities - known CVEs in unpatched systems and sometimes zero-days
- Remote access - poorly secured RDP, VPN or TeamViewer connections used by suppliers without an adequate firewall, VPN or MFA
- Supply chain - compromised updates, software or hardware from suppliers (supply chain risk); in 2017 NotPetya spread through a hijacked update of Ukrainian accounting software
- Edge network devices - vulnerable routers and firewalls; in the FrostyGoop case the attackers most likely got in through a vulnerable, internet-facing MikroTik router
🏭 Which malware has attacked industrial systems?
A small group of malware families has now been built specifically to manipulate industrial control systems. In addition, ordinary IT malware regularly hits the OT environment.
| Year | Malware | Target | Effect |
|---|---|---|---|
| 2010 | Stuxnet | Siemens S7-315/S7-417 PLCs at the Natanz enrichment plant (Iran) | Centrifuges damaged while operators saw normal values; spread via USB and four Windows zero-days |
| 2015 | BlackEnergy | Three Ukrainian distribution system operators | Around 225,000 customers without power for up to six hours; KillDisk wiped systems |
| 2016 | Industroyer | Pivnichna substation near Kyiv | Roughly a fifth of Kyiv without power for about an hour; first malware built specifically to attack a power grid, via IEC 60870-5-104 and IEC 61850 |
| 2017 | TRITON | Schneider Electric Triconex safety system at a Saudi petrochemical plant | First malware aimed at a safety instrumented system; the plant shut down safely |
| 2017 | NotPetya | Worldwide, including Maersk and Merck | Wiper disguised as ransomware; damage estimated at over 10 billion dollars |
| 2021 | Colonial Pipeline | IT network of a US fuel pipeline operator | DarkSide ransomware on IT; the pipeline was shut down as a precaution for about five days |
| 2022 | Industroyer2 | Ukrainian energy company | Detected and stopped before a power outage occurred |
| 2022 | PIPEDREAM | Schneider Electric and Omron PLCs, OPC UA servers, CODESYS | Modular attack toolkit, discovered before deployment |
| 2024 | FrostyGoop | District heating in Lviv via Modbus TCP | More than 600 apartment buildings without heating for almost two days |
The lesson from this series: OT malware is becoming more generic. Where Stuxnet was custom-built for one installation, PIPEDREAM and FrostyGoop target widely used protocols and devices.
💥 What are the risks of malware?
- Production downtime - standstill of lines or entire plants, even when only the IT network has been hit
- Physical damage and safety - manipulated controllers or disabled safety systems can endanger installations and people
- Data breaches - loss of intellectual property, recipes or personal data
- Lengthy recovery - encrypted or wiped systems often have to be rebuilt from scratch
- Reputational damage and loss of trust among customers and regulators
- Compliance issues - notification obligations under NIS2 and the Dutch Cybersecurity Act, and under the GDPR in the event of a data breach
🔐 Why is antivirus difficult in OT?
Classic antivirus works well on office PCs, but in OT it runs into a number of practical constraints:
- Vendor approval - DCS and SCADA vendors often support their system only with an approved antivirus version and tested signature updates
- Performance - real-time scanning can slow down an HMI or historian, which is why process folders are often excluded
- No internet - systems in an isolated network only receive signatures via a managed update server in the DMZ
- Legacy operating systems - older Windows versions no longer receive updates from the antivirus vendor
- No agent possible - PLCs, RTUs and other embedded devices cannot run security software
OT therefore relies more on application whitelisting (only approved programs may run) and passive network monitoring than on signatures alone.
✅ How do you protect OT and IT against malware?
IEC 62443-3-3 requires protection against malicious code through requirement SR 3.2, with an enhancement for the entry and exit points of a zone, and use control for portable and mobile devices through SR 2.3. NIST SP 800-82 (Revision 3, 2023) provides similar guidance for OT environments. A practical step-by-step approach:
- Inventory - map all systems, operating systems and connections; you cannot protect what you do not know
- Segment - separate IT and OT with a DMZ and divide OT into zones using network segmentation and VLANs, so that a worm cannot spread freely
- Control removable media - USB control with a scanning station (sheep dip) and blocking of unknown USB devices
- Restrict executable code - application whitelisting on HMIs and engineering stations, plus hardening by disabling unnecessary services
- Secure remote access - via a jump server with MFA and time-limited access for suppliers, in line with Zero Trust
- Detect - EDR where the vendor allows it, anomaly detection on the OT network and central logging in a SIEM
- Patch based on risk - patch management aligned with maintenance windows and vendor advice
- Train staff - awareness against social engineering and phishing
- Prepare for recovery - offline or immutable backups of servers and PLC programs, a rehearsed incident response plan and disaster recovery planning
An air gap alone is no guarantee: Stuxnet proved that USB sticks, supplier laptops and service kits can bridge the separation.
🇳🇱 What does malware mean for Dutch organisations?
Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, has been in force. It replaces the Network and Information Systems Security Act (Wbni) and applies to an estimated 8,000-plus organisations. Essential and important entities must take appropriate measures against threats including malware and must report significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The Dutch NCSC publishes threat information and alerts organisations to concrete infections. For critical infrastructure operators such as drinking water and energy companies, malware on OT systems is one of the key scenarios in risk analyses.
❓ Frequently asked questions
What is the difference between a virus and malware?
Malware is the umbrella term for all malicious software. A virus is one specific type of malware that attaches itself to files and spreads when those files are opened. Worms, trojans, ransomware and spyware are other forms of malware.
Can malware infect a PLC?
Yes, but only specialised malware such as Stuxnet, TRITON and PIPEDREAM can modify PLC logic or firmware. Malware usually infects a Windows system such as an engineering station first and then uses it to send new code to the PLC. Integrity checks on PLC programs and securing engineering stations reduce that risk.
Is an air gap enough protection against malware?
No, an air gap reduces the risk but does not rule out malware. USB sticks, supplier laptops and hidden network connections can bridge the separation, as Stuxnet demonstrated in 2010. An air gap should therefore always be combined with USB control, whitelisting and monitoring.
Why is ransomware dangerous for OT if it only hits IT?
Ransomware in the IT network can disable planning, invoicing and the link with OT, leading companies to stop production as a precaution. At Colonial Pipeline in 2021 the OT environment was not affected, yet the pipeline was still shut down for about five days. Proper separation between IT and OT limits this domino effect.
Does EDR work in an OT environment?
EDR works on Windows servers, HMIs and engineering stations in OT, provided the system vendor has approved the software and the agent is first tested in monitoring mode. EDR cannot run on PLCs and other embedded devices. Passive network monitoring fills that detection gap.
How do you recognise a malware infection in OT?
Signs of malware in OT include unexpected network connections, new devices or protocols, modified PLC programs and slow or freezing HMIs. Passive network monitoring and comparison against a known baseline make these deviations visible. An IOC feed from the NCSC or a vendor helps to recognise known malware.
📌 In summary
Malware is malicious software that damages, spies on or abuses systems or data, and in OT environments it can lead to production downtime and even physical damage. Protection requires a combination of segmentation, USB control, whitelisting, detection, backups and aware staff, tailored to the constraints of industrial systems.